WARNING: A CRITICAL VULNERABILITY IS AFFECTING ANGULAR EXPRESSIONS
Bronnen
https://github.com/peerigon/angular-expressions/security/advisories/GHSA-5462-4vcx-jh7j
Risico’s
Moreover, a Proof-of-Concept exploit has been published, thus rendering the exploitation of this vulnerability a lot easier for attackers.
Beschrijving
CVE-2024-54152 allows an attacker to write a malicious expression that escapes the sandbox to execute arbitrary code on the underlying system.
Aanbevolen acties
Patch
The Centre for Cybersecurity Belgium strongly recommends installing updates for the vulnerable software mentioned in the present advisory.
Workaround
Two possible workarounds are possible:
- Disable access to function "_ proto _" globally.
- Make sure to use the function with just one argument.
Monitor/Detect
The CCB recommends organizations upscale monitoring and detection capabilities to identify any related suspicious activity, ensuring a swift response in case of an intrusion.
In case of an intrusion, you can report an incident via: https://ccb.belgium.be/en/cert/report-incident
While patching appliances or software to the newest version may provide safety from future exploitation, it does not remediate historic compromise.